API

We would like to access Potentially Unsecured Credentials through the API. We already use scripts to trigger automation around the signals, however, we must export the list of manually each run. Please make /v1/signals a thing!

We use a custom browser plugin to pop alert banners when things need attention in Huntress. This works really well for all team members when it comes to incidents but when it comes to escalations there doesn't seem to be any way to review/check for these under the API.

We are working with Rewst for process automation. It'd be great to be able to uninstall agents via API, create/delete users, isolate machines, etc..

Allow the uninstall of Huntress agents via API request. Since tamper protection has been introduced to the Huntress agent, enabling the feature means RMMs can no longer automatically uninstall Huntress from a device. Without an API endpoint to trigger an uninstall, this breaks automation processes and adds new manual tasks that can only be completed in the Huntress portal.

It's nice that the API has the ability to send the report location URL via the API, but what is the possibility of actually getting the report details like # of computers/servers, changes analyzed, autoruns reviewed, persistence breakdown, # of canaries deployed, incident summary & log for each report back in json?

It would be great if there were API endpoints added for SAT and SIEM data. Even just general usage information added to /v1/organizations , as there already is for 'agents_count', and 'microsoft_365_users_count'.

Hi Team, I wanted to bring up the possibility of a SIEM API to help us pull usage data for customer account billing. Our MSP partners are fully migrating their EDR, MDR, Security Training, and SIEM stack to the Huntress ecosystem. We currently have three integrations in place for retrieving usage data for EDR, MDR, and SAT. Since SIEM is a newer addition, I wanted to check if an API for this might already exist or if one is planned. Thank you!

Tickets are not created for individual identities for escalation requests. This is causing issues as we cannot track when a new identity has been added and have to review all escalations manually. Ie when we resolve an escalation for an identity it does not resolve the entire escalation.

Would be great to be able to /delete/{id} via the API to automatically clean up our organizations for when devices get wiped/replaced or a client leaves us

With the new manager notifications being sent, being able to get the learner's manager information via the SAT API can be useful